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PREFACE 


This  document  is  the  initial  version  of  the  Air  Force  autonomous 
spacecraft  goals  document.  As  stated  in  SCOPE,  Section  III,  these  qoals 
will  be  developed  so  as  to  be  broadly  applicable  to  a  wide  range  of  mis¬ 
sions.  Initially,  emphasis  is  placed  on  three-axis-stabilized,  geosynchro¬ 
nous,  communication  satellites.  As  additional  information  becomes 
available  and  is  assimilated,  subsequent  revisions  of  this  document  will 
refine  and  incorporate  goals  dictated  both  by  general  and  specific  mission 
needs.  Sources  for  inputs  to  this  document  are  the  entire  U.  S.  Air  Force 
Space  Division  community,  including  Aerospace  Corporation,  the  industrial 
suppliers,  and  NASA/Air  Force  interagency  working  groups.  These  sources  are 
invited  to  provide  comments  and  inputs  to  JPL  for  future  revisions. 
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SECTION  i 
INTRODUCTION 


During  the  Summer  of  1980,  the  Space  Division  of  the  United  States  Air 
Force  initiated  planning  for  a  spacecraft  autonomy  program  intended  to 
provide  a  sound  technology  base  for  significantly  upgrading  the  autonomous 
capability  of  defense  satellites  by  the  end  of  the  decade.  The  broad  goal 
established  for  this  proqram  was  to  increase  mission  readiness  by  (listed  in 
order  of  priority): 

(1)  Enhancing  spacecraft  survivability  against  on-board  failures. 

(2)  Enhancing  spacecraft  survivability  against  hostile  acts. 

(3)  Reducing  spacecraft  dependence  on  ground  stations,  thereby 
enhancing  the  capability  for  system  reconstitution  if  the  qround 
stations  were  disabled. 

(4)  Achieving  an  early  satellite  health  and  ephemeris  maintenance 
capability  by  Fiscal  Year  1987  (FY87),  with  spacecraft  launched 
after  this  date  capable  of  performing  missions  for  unattended 
periods  on  the  order  of  six  months. 


An  additional  goal  for  this  program  is  to  utilize  the  enhanced  autonomy 
of  spacecraft  to  increase  the  cost-effectiveness  of  ground  operations. 

The  next  step  was  to  extend  these  broad  goals  into  specific  "working" 
goals  which  would  guide  the  development  efforts  of  those  participating  in 
the  autonomy  program;  hence,  the  evolution  of  this  document. 
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SECTION  II 


PURPOSE 


The  purpose  of  this  document  is  to  define  goals  for  autonomous  spacecraft 
which,  if  implemented,  will  instill  into  Air  Force  operational  satellites 
launched  in  the  late  1980's  a  significant  autonomous  maintenance  and  navigation 
capability.  This  capability  is  required  to  increase  spacecraft  survivability. 
Specifically,  the  purpose  of  these  goals  is  to: 

(1)  Provide  a  common  working-level  understanding,  between  the  various 
participating  groups,  of  the  engineering  objectives  of  the  Air  Force's 
autonomous  spacecraft  effort. 

(2)  Provide  a  tool  for  assessing  the  autonomous  capability  of  existing  and 
future  spacecraft. 

(3)  Provide  statements  of  autonomy-related  performance  needs  in  a  format 
generally  suitable  for  incorporation  into  procurement  documentation. 

(4)  Provide  a  common  basis  for  assessing  incremental  progress  in  achieving 
autonomy  objectives  and  for  estimating  the  incremental  cost  of  greater 
autonomous  capability. 


SECTION  III 


SCOPE 


Goals  presented  in  this  document  are  intended  to  be  generic,  i.e., 
appropriate  for  application  to  the  broad  spectrum  of  Earth-orbitinq 
satellites  employed  by  the  Air  Force.  These  goals  are  intended  to  be 
applicable  to  the  complete  set  of  missions  and  orbit  classes  common  to  Air 
Force  Programs,  such  as: 

(1)  Surveil lance  missions 

(2)  Meteorological  mission 

(3)  Communication  missions 

(4)  Navigation  missions 

(5)  Test  mi ssions 

Specific  mission  requirements  are  expected  to  be  used  to  select  the 
appropriate  subset  of  the  goals  which  are  to  be  applicable  to  that  mission. 
These  goals  are  formulated  such  that  they  suggest  a  universally  desirable 
autonomous  capability  without  prejudice  or  bias  towards  a  particular 
hardware/software  implementation  approach. 

For  the  purpose  of  this  goals  document,  autonomy  is  viewed  as  an 
additional  capability  to  that  of  performance  capability  and  intrinsic 
reliability,  as  follows: 

(1)  Performance  capability  -  the  capability  to  support  payload/mission 
requirements  when  spacecraft  elements  are  functioning  properly, 
including  the  ability  to  endure  insofar  as  consumable  are 
concerned. 

(2)  Intrinsic  reliability  -  the  "robustness"  of  a  spacecraft  that  comes 
about  through  derated  use  of  components,  through  design,  parts 
screening,  qualification  testing  to  eliminate  weakness,  and  the 

1  ike. 

(3)  Autonomous  capability  -  that  additional  capability  designed  into  a 
spacecraft  which  permits  it  to  perform  on-board  task  execution 
(with  decision  making)  without  Intervention  or  control  from  the 
ground. 

Achievement  of  a  level  of  autonomous  capability  implied  by  these  goals 
does  not  reduce  the  significance  of  performance  goals  or  of  Intrinsic 
reliability  goals.  It  Is  assumed  that  emphasis  on  achieving  performance  and 
Intrinsic  reliability  will  be  maintained  and  that,  additionally,  a  specified 
level  of  autonomous  capability  will  simply  be  included  which  will  contribute 
significantly  to  a  spacecraft's  overall  reliability  and  life  while  providing 
an  ability  to  operate  without  frequent  ground  station  interaction. 


SECTION  IV 


LEVELS  OF  AUTONOMY 


In  order  to  provide  a  means  of  communication  on  the  matter  of  autonomous 
capability,  the  concept  of  "levels  of  autonomy"  is  introduced.  The  selected 
levels  of  autonomy  serve  only  to  provide  a  rough  quantification  of 
increasing  capability  to  operate  autonomously.  This  is  represented  by  a 
scale  of  0  (least  capable)  to  10  (most  capable).  The  levels  of  autonomy  are 
defined  in  the  appendix  and  the  goals  presented  herein  are  intended  to 
correspond  to,  and  to  help  define,  an  autonomy  level  of  about  Level  5. 


It  is  intended  that  the  "levels  of  autonomy"  concept  be  utilized  to: 

(1)  Assess  the  autonomous  capability  of  existing  designs. 

(2)  Aid  in  measuring  progress  toward  the  achievement  of  autonomy  goals. 


SECTION  V 

GOALS  AND  GOAL  STRUCTURE 


Two  types  of  goals  have  been  defined.  They  are  policy  goals  and 
implementation  goals.  These  goals  must  be  stated  in  such  a  manner  that 
incremental  autonomous  capability  may  be  added  to  specific  spacecraft  in  the 
near  term. 


A.  FOCUS  OF  POLICY  GOALS 

Policy  goals  are  focussed  toward  attainment  of  major  advances  in  the 
autonomous  capabilities  of  Air  Force  spacecraft.  They  cut  across  all  classes  of 
spacecraft  and  missions.  Their  attainment  is  required  to  achieve  the  minimum 
objectives  of  the  autonomous  effort.  Policy  qoals  are  divided  into  four 
categories: 

(1)  Ground  interaction  reduction 

(2)  Spacecraft  integrity  maintenance 

(3)  Autonomous  features  transparency 

(4)  On-board  resource  management 


B.  FORMULATION  OF  IMPLEMENTATION  GOALS 

Implementation  goals  have  been  formulated  in  response  to  policy  goals. 
They  assume  an  implementation  which  is  constrained  by  both  technology  and 
resources.  Implementation  goals  are  supportive  of  the  technical  and 
programmatic  drivers  of  each  mission  and  are  defined  in  each  of  the  following 
functional  areas: 

(1)  Systems  (including  Thermal  Control  and  Validation) 

(2)  Electrical  Power  and  Pyrotechnics 

(3)  Attitude,  Translation,  and  Pointing  Control  (ATPC) 

(4)  Data  Processing 

(5)  Payload 

(6)  Telemetry,  Tracking,  and  Command  (TT&C) 

(7)  Navigation 

(8)  Propulsion 
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Within  this  structure,  implementation  goals  for  the  systems  areas, 
which  will  include  design,  validation,  and  operation  considerations,  flow 
down  to  and  pervade  the  other  functional  areas.  For  this  reason,  implement¬ 
ation  goals  for  systems  are  not  repeated  within  each  of  the  other  functional 


SECTION  VI 
POLICY  GOALS 


The  intent  of  the  following  policy  goals  is  to  characterize  explicitly 
an  autonomous  spacecraft  capability  of  Level  5  (as  defined  in  the  appendix), 

A.  GROUND  INTERACTION  REDUCTION 

Autonomous  spacecraft  shall  be  capable  of  successfully  performing  their 
mission  function  for  an  extended  period  of  time,  without  ground  support,  and 
at  a  specified  level  of  conflict.  Specifically: 

(1)  Autonomous  spacecraft  shall  operate  without  performance 
degradation  for  up  to  60  days  from  the  last  initialization 
update. 

(2)  Autonomous  spacecraft  shall  operate  for  up  to  six  months  from  the 
last  initialization  update.  They  shall  do  so  within  acceptable 
performance  degradation  limits  for  mission-prioritized  functions 
as  defined  by  each  mission. 

(3)  Autonomous  spacecraft  shall  be  able  to  recover  from  certain 
mission-unique  failure  modes.  These  failure  modes  shall  be 
Identified  and  prioritized. 

(4)  Autonomous  spacecraft  shall  be  capable  of  restoring  themselves  to 
nominal  mission  performance  after  occurrence  of  a  combination  of 
non-simultaneous  faults,  defined  a-priori,  subject  to  the  avail¬ 
ability  of  spare  resources.  Knowledge  of  occurrence  of  such 
faults  shall  be  available  to  the  ground  segment  upon  request. 

(5)  Autonomous  spacecraft  shall  tolerate  transient  faults  without 
significant  loss  of  mission  capability.  Knowledge  of  occurrence 
of  such  faults  shall  be  available  to  the  ground  segment  upon 
request. 

B.  SPACECRAFT  INTEGRITY  MAINTENANCE 

The  integrity  of  the  payload  data  stream  and  usefulness  of  the 
spacecraft  shall  not  be  reduced  by  the  addition  of  autonomous  features. 
Specifical ly: 

(1)  Autonomous  features  shall  not  decrease  the  performance  and 
functional  capability  of  the  spacecraft. 

(2)  Autonomous  features  shall  not  adversely  affect  the  wea rout 
mechanisms  of  consumables  of  the  spacecraft. 

(3)  Autonomous  features  shall  not  appreciably  Increase  the  period 
required  for  checkout  and  Initialization  on-orbit. 
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(4)  Autonomous  features  shall  restore  the  spacecraft  function  after 
cessation  of  a  hostile  threat  condition. 


C.  AUTONOMOUS-FEATURES  TRANSPARENCY 

Autonomous  features  shall  be  transparent  to  the  spacecraft  user. 
(Exceptions  may  include  periods  of  fault  isolation  and  recovery  following  a 
fault  or  periods  during  orbit  maneuvering.)  Specifically: 

(1)  Autonomous  spacecraft  shall  be  maintained  in  a  state  such  that 
they  are  capable  of  receiving  ground  commands. 

(2)  The  ground  segment  shall  be  able  to  exert  executive  control  over 
autonomous  management  activities  of  the  spacecraft.  Faults  or 
combinations  of  non-slmultaneous  faults  shall  not  prevent 
executive  control  by  the  ground  segment. 


D.  ON-BOARD  RESOURCE  MANAGEMENT 

Management  of  on-board  resources  is  mission-  and  mode-dependent.  One 
may  choose  to  accept  a  shortened  useful  lifetime  in  order  to  obtain  maximum 
performance  in  a  high  level -of-confl ict  situation.  Specifically: 

(1)  Autonomous  spacecraft  shall  be  capable  of  adjusting  space-system 
performance  for  various  mission-critical  modes  by  managing 
available  spare  resources  and  expendables  even  in  the  presence  of 
faults. 

(2)  Software  that  Implements  autonomous  functions  shall  be 
reprogrammable  from  the  ground. 

(3)  Software  shall  accommodate  reprogramming  so  that.  In  the  event  of 
depletion  of  certain  resources  and/or  expendables,  mission 
performance  can  be  maximized  within  the  limitations  of  the 
remaining  resources. 
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SECTION  VII 


— - 


IMPLEMENTATION  GOALS 


A.  SYSTEMS  (INCLUDING  THERMAL  CONTROL  AND  VALIDATION) 

(1)  The  hardware  and  software  architectures  chosen  shall  not  preclude 
the  ability  to  add  additional  autonomous  capabilities. 

(2)  The  system  shall  be  capable  of  reconfiguration  of  spare  resources 
at  the  lowest  practical  and  reasonable  level. 

(3)  During  autonomous  operation,  performance  degradation  may  be 
allowable  in  specific  cases,  but  only  after  spares  are  exhausted. 
"Graceful"  degradation  is  preferred  over  precipitous  change. 

Where  possible,  autonomous  functions  shall  mitigate  the  effects  on 
performance  of  a  functional  failure  which  occurs  after  spares  are 
exhausted. 

(4)  The  adverse  effects  of  faults  shall  not  propagate  beyond  a 
subsystem  interface  if  the  faulty  subsystem  possesses  sufficient 
spare  resources  to  recover  from  the  fault  condition.  Ambiguous 
faults  within  subsystem  interfaces  and  subsystems'  shared  resource 
allocation  shall  be  resolved  by  system-level  mechanisms. 

(5)  All  fault  detection  and  switching  mechanisms  shall  be  designed  to 
minimize  false  alarms. 

(6)  The  spacecraft  shall  manage  propellant  usage  during  autonomously 
conducted  orbit-adjust  maneuvers  (stationkeeping  and/or 
relocation/  restoration)  to  assure  mission  lifetime  requirements 
are  met. 

(7)  The  spacecraft  shall  maintain  system  temperature  control  for  all 
functional  states  and  mission  thermal  environments.  Furthermore, 
the  thermal -control  function  shall  autonomously  ensure,  for  all 
mission  phases,  that  non-catastrophic  subsystem  failures  cannot 
induce  thermal  failures  which  will  cause  propagation  of  the 
initial  failure  within  the  satellite  system. 

(8)  The  spacecraft  shall  utilize  selected  parametric  data  (electrical 
profiles,  thermal  characteristics,  and  state  changes  in  the 
ambient  environments,  as  a  minimum)  for  on-board  forecasting  of 
incipient  fault  conditions  within  each  of  the  functional  areas. 

(9)  The  execution  of  any  autonomous  event  or  activity  shall  not  be 
permitted  to  conflict  with  other  (planned  or  autonomous) 
activities. 

(10)  The  spacecraft  shall  maintain  performance  and  state-change  records 
(an  audit  trail)  to  allow  for  reconstruction  of  performance,  fault 
detection,  and  fault  correction  activities  and  determination  of 
the  status  of  resources  and  expendables. 
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(11)  The  autonomous  spacecraft  shall  maintain  the  spacecraft 

center-of-mass  and  center-of-pressure  within  limits  required  to 
support  the  mission. 

Spacecraft  autonomy  shall  be  capable  of  being  validated  on  the 
ground  and  verified  on-orbit. 

(13)  Validation  shall  determine  the  design  margin  (when  applicable)  of 
the  autonomous  mechanisms. 

(14)  On-orbit  validation  and  testing  of  autonomy  features  shall  be 

accomplished  without  disrupting  normal  space-segment  operations 
wherever  possible.  In  those  cases  where  some  disruption  is 
unavoidable,  restoration  of  normal  space-seqment  operation  shall 
be  an  entirely  autonomous  process  which  is  performed  in  a  timelv 
manner.  J 


ELECTRICAL  POWER  AMO  PYROTECHNICS 

(1)  Detection  and  isolation  of  load  faults  in  power-bus  loads  shall 
be  accomplished. 

(2)  Power-margin  management  for  power  bus  (including  power  sources 
power-conditioning  elements,  and  user  loads)  shall  be  maintained. 

(3)  Management  and  control  of  the  battery  state-of-charge,  discharge, 
and  reconditioning  functions  shall  be  maintained. 


ATTITUDE,  TRANSLATION,  AND  POINTING  CONTROL  (ATPC) 

(1)  The  ATPC  function  shall  be  capable  of  autonomous  attitude 
reference  acquisition  and  reacquisition. 

(2)  The  ATPC  function  shall  be  capable  of  autonomous  fault  detection, 
correction,  and  recovery  of  Its  subsystem  elements  (sensors, 
computers,  actuators). 

(3)  The  ATPC  function  shall  be  capable  of  autonomous  inertial  and 
celestial  sensor  calibrations  to  compensate  for  changes  and/or 
degradation  of  sensor  parameters.  Compensation  activities  shall 
be  transparent  to  the  payload  user. 

(4)  Autonomous  translation  control  shall  support  stationkeeping  to  the 
accuracies  required  to  meet  mission  requirements. 

(5)  Autonomous  attitude  determination  shall  support  commanding  of 
antennas  and  payload  instrumentation  pointing  to  accuracies 
required  to  support  the  mission  requirements. 
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(6)  The  ATPC  function  shall  he  capable  of  autonomous  attitude-control 
propellant  management  by  changing  operational  mode  and/or 
parameters. 

(7)  The  ATPC  function  shall  be  capable  of  high-level  command  and 
decision-making  for  activities  such  as  initiation  of  turns  for 
star  reacquisition,  translation  control,  and  instrument  pointing. 


D.  DATA  PROCESSING 

(1)  The  spacecraft  data-processing  function  shall  be  provided  with 
adequate  parametric  data  from  spacecraft  sensors  and  subsystems  so 
that  spacecraft  performance,  resource  status,  and  integrity  can  be 
determined  on-board. 

(2)  The  spacecraft  data-processing  function  shall  be  capable  of 
performing  the  necessary  diagnostic  analysis  (from  available 
parametric  data)  required  to  assess  the  performance,  resource 
status,  and  integrity  of  the  spacecraft. 

(3)  The  spacecraft  data-processing  function  shall  be  capable  of 
implementing  the  necessary  diagnostic  analysis  (from  available 
parametric  data)  required  to  assess  the  performance,  resource 
status,  and  integrity  of  the  spacecraft. 

(4)  The  spacecraft  data-processing  function  shall  provide  the 
necessary  spacecraft  control  functions  (commands)  required  for 
autonomous  operation  of  the  spacecraft-control  and  monitoring 
function. 

(5)  The  spacecraft  data-processing  function  shall  be  capable  of 
storing  a)  pertinent  parametric  data,  b)  diagnostic-analysis 
results,  c)  data  reflecting  control  actions  taken,  and  d)  response 
data  to  autonomous  control  actions  necessary  to  allow  ground 
reconstruction  of  spacecraft  state  for  time  intervals  up  to  six 
months.  These  data  shall  be  available  for  ground  assessment  upon 
request. 


E.  PAYLOAD 

(1)  Failure  modes  within  the  payload  function  shall  not  propagate  into 
other  spacecraft  functions. 

(2)  Redundant  functional  command  and  control  paths  through  the  peyload 
function  shall  not  be  inhibited  by  autonomous  features. 


F.  TELEMETRY,  TRACKING,  AND  COMMAND  (TT&C) 

(1)  The  TTSC  function  will  cause  a  message  to  be  transmitted  to  the 
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ground  at  the  first  opportunity  following  an  autonomous  management 
activi ty. 

(2)  The  TT&C  function  shall  be  prepared  to  receive  ground  commands  at 
any  time  while  in  the  autonomous  state. 

(31  The  TT&C  function  shall  be  capable  of  transmitting,  at  the 

discretion  of  ground  control,  normal  telemetry  and  ranging  while 
in  the  autonomous  state. 


G. 


NAVIGATION 


(1)  The  spacecraft  shall  maintain  the  orbit  within  specified  limits 
for  60  days  from  the  last  required  initialization. 


(21  If  qround  supervisory  contact  is  not  reestablished  after  60  days 
of  autonomous  navigation,  the  spacecraft  wi 1 1  continue  to  operate 
within  acceptable  limits  even  if  the  navigation  function 
performance  is  deqraded.  Performance  degradation  will  be  measured 
by  the  effects  of  degraded  orbit  control  on  payload  performance. 


(31  Spacecraft  orbit  state  or  orbit-derived  data  shall  be  available  to 
other  on-board  subsystems  and/or  user  ground  facilities  as 
required.  Potential  examples:  Sun-Earth-vehicle  angle  to 
attitude  control,  Sun-occulation  predictions  to  attitude  control 
and  power,  lunar-occul ation  prediction  to  attitude  control ,  and 
station-acquisition  data  to  ground-  and  antenna-pointing  vector. 


(41  The  spacecraft  shall  have  the  capability  to  accept  initialization- 
state  data  from  the  ground  or  an  external  source  such  as  the 
Global  Positioning  System.  It  shall  have  a  limited-state 
reinitialization  capability  for  some  range  of  orbit  parameters 
perturbed  about  the  nominal  operating  orbit. 

(51  The  navigation  function  shall  be  capable  of  adjusting  performance 
limits  based  upon  the  availability  of  limited  resources. 


(6)  The  navigation  function  shall  be  capable  of  executing  an  evasive 
maneuver,  if  required. 


(71  The  navigation  function  shall  be  capable  of  reestablishing  the 
normal  orbit,  within  acceptable  limits,  following  an  evasive 
maneuver,  if  required. 


PROPULSION 

(1)  The  propulsion  function  shall  detect  and  isolate  autonomously  any 
failed  or  degraded  thrusters  and  reconfigure  the  thruster 
complement  to  support  mission  functions. 

(2)  The  propulsion  function  shall  detect  and  isolate  autonomously  any 
leaking  propellant-supply  components,  including  tanks. 

(3)  The  propulsion  function  shall  manage  autonomously  any  limited-life 
components  (e.g.,  monopropellant  thrusters)  to  meet  life-time 
requi rements. 

(4)  The  propulsion  function  shall  be  capable  of  estimating  a-priori 
any  impulse  delivered  to  support  navigation  maneuvers  and 
attitude-control  functioning. 
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APPENDIX 

LEVELS  OF  AUTONOMY 


In  performance  of  a  space  mission,  four  major  policy  goal  categories 
have  been  identified.  These  are: 

(1)  Ground  Interaction  reduction. 

(2)  Spacecraft  integrity  maintenance. 

(3)  Autonomous  features  transparency. 

(4)  On-board  resource  management. 


The  extent  to  which  these  goals  have  been  accomplished  to  date  has  been 
through  a  mix  of  functions  resident  in  either  the  space  segment  or  the 
ground  segment.  Furthermore,  the  ground  segment,  as  an  integral  part  of  the 
total  system,  has  been  responsible  for  accomplishing  maintenance,  navigation 
mission  control,  and  payload  data  processing.  Thus,  only  minimal  spacecraft 
autonomy  has  been  needed. 

The  levels  of  autonomy  described  in  this  appendix  are  used  to  define  a 
step-wise  increase  in  spacecraft  autonomous  capability.  By  proceeding 
through  the  levels,  autonomous  capability  is  Increased  in  the  space  segment 
and  dependency  on  the  ground  segment  Is  reduced. 

The  levels  of  autonomy  are  described  as  follows: 

Level  0.  A  design  without  redundant  elements  which  meets  all  mission' 
needs  by  operating  without  the  on-board  control  of  state  parameters  (such  as 
rates  and  position).  May  respond  to  a  prespecified  vocabulary  of  external 
commands,  but  cannot  store  command  sequences  for  future  time-or  event- 
dependent  execution  or  validate  external  commands.  (An  open-loop,  on-board 
system  controlled  from  the  ground.) 

Level  1.  Includes  Level  0  but  uses  on-board  devices  to  sense  and 
control  state  parameters  (such  as  rates  and  positions)  in  order  to  meet 
performance  needs.  Is  capable  of  storing  and  executing  a  prespecified 
command  sequence  based  on  mission-critical  time  taqs.  Will  respond  to 
prespecified  external  commands,  but  cannot  validate  external  commands. 
Functionally  redundant  modes  may  be  available  for  a  degraded-performance 
mission. 

Level  2.  Include  Level  1  plus  the  use  of  block  redundancy.  Ground- 
controlled  switching  of  spare  resources  Is  required.  Uses  cross-strapping 
techniques  to  minimize  effect  of  critical  command  link  (uplink)  failure 
modes.  Significant  ground-operator  Interaction  Is  required  to  restore 
operations  after  most  faults  if  spare  spacecraft  resources  are  available. 


17 


Requires  operator  interaction  for  fault  recovery.  Is  capable  of  storing  and 
executing  mission-critical  events  which  are  sensed  on-board  and  may  be 
independent  of  time. 

Level  3.  Includes  Level  2  and  is  capable  of  sensing  prespecified 
mission-critical  fault  conditions  and  performing  predefined  self-preserving 
(entering  a  safe-hold  state)  switching  actions.  Is  capable  of  storing 
contingency  or  redundant  software  programs  and  being  restored  to  normal 
performance  (maintaining  the  command  link  with  a  single  link  fault)  in  the 
event  of  a  failure.  Timers  may  be  used  to  protect  resources.  Requires 
ground  operator  interaction  for  fault  recovery.  In  general,  the  failure  to 
sense  and/or  execute  the  mission-critical  event(s)  will  cause  mission 
failure  or  loss  of  a  major  mission  objective. 

Level  4.  Includes  Level  3  but  is  also  capable  of  executing 
presped  fled  and  stored  command  sequences  based  on  timing  and/or  sensing  of 
mission  events.  Ground-initiated  changes  to  command  sequences  may  be 
checked  on-board  for  syntactical  errors  (parity,  sign,  logic,  time).  Uses 
coding  or  other  self-checking  techniques  to  minimize  the  effects  of 
internally  generated  data  contamination  for  prespecified  data  transfers. 
Requires  ground-operator  interaction  for  fault  recovery.  In  general, 
failure  to  sense  and/or  execute  the  mission  event(s)  or  state-changes 
(excluding  failure-induced  state-changes)  will  cause  mission  failure  or  loss 
of  a  major  mission  objective. 

Level  5.  Includes  Level  4  and  is  also  autonomously  fault-tolerant.  Is 
capable  of  operating  in  the  presence  of  faults  specified  a-priori  by 
employing  spare  system  resources,  if  available,  or  will  maximize  mission 
performance  based  upon  available  capability  and/or  available  expendables 
(i.e.,  self-loading  of  contingency  programs)  without  ground  intervention. 

Level  6.  Includes  Level  5  and  is  capable  of  functional  commanding  with 
on-board  command-sequence  generation  and  validation  prior  to  execution. 
Functional  commanding  may  include  a  high-level,  pseudo-English  language, 
spacecraft-system/operator  communication  and  control  capability. 

Level  7.  Includes  Level  6  and  is  capable  of  autonomously  responding  to 
a  changing  external  environment,  defined  a-priori,  so  as  to  preserve  mission 
capability.  The  capability  to  change  orbit  in  order  to  compensate  for 
degradation  or  to  protect  the  satellite  from  an  external  threat  is 
included. 

Level  8.  Includes  Level  7  and  is  capable  of  operating  successfully 
within  the  presence  of  latent  design  errors  which  could  cause  loss  of  major 
mission  objectives. 

Level  9.  Includes  Level  8  and  is  capable  of  task  deduction  and 
Internal  reorganization  based  upon  anticipated  changes  in  the  external 
environment.  This  situation  is  exemplified  by  multiple  satellites  operating 
in  a  cooperative  mode.  In  the  event  of  a  satellite  failure,  remaining 
satellites  would  detect  autonomously  the  condition  (task  deduction)  and  may 
generate  and  execute  orbit-and  spacecraft-reconfiguration  commands. 
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Level  10.  Includes  Level  9  and  is  capable  of  internal  reorganization 
and  dynamic  task  deduction  based  on  unspecified  and  unknown/unanticipated 
chanqes  in  external  environment.  The  system  will  strive  to  maximize  system 
utility.  Thus,  mission  objectives  should  be  adaptive  and  automatically 
reprogrammable.  System  resources  should  be  maximized  to  preserve  task 
adaptiveness. 
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